registry / Credential exfiltration / @feedmepos/mf-inventory-portal
@feedmepos/mf-inventory-portal
## Description
This report shows the evidence for @feedmepos/mf-inventory-portal@1.8.0-dev.20. 1 of 63 known versions is blocked or flagged. The newest version, 1.9.0, is allowed. See all versions.
AI Security Review
scanned 1d ago · by lpm-firewall-aiThe reachable 401 refresh path sends the active session token to a fixed host outside the package’s configured service backends. This is concrete credential disclosure supporting a publish block.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
An authenticated request receives a 401 response and invokes token refresh.
Impact
The fixed recipient receives a copy of the service token, which could enable access to the associated account.
Mechanism
The refresh routine posts the supplied session token to account.feedmedev.cc.
Attack narrative
The package’s exported entrypoint imports the runtime bundle. On a 401 response, the authenticated request handler passes the current session token to refreshAuth. That routine posts the token to a fixed account.feedmedev.cc host, while ordinary portal and inventory backends use feedmeapi.com hosts. The token transfer is active runtime behavior and is not guarded by recipient-specific consent.
AI rationale
The reachable 401 refresh path sends the active session token to a fixed host outside the package’s configured service backends. This is concrete credential disclosure supporting a publish block.
Evidence
package.jsondist/app.jsdist/app-D38sV2ls.js
Network endpoints1
account.feedmedev.cc
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package exports dist/app.js, which imports the flagged runtime bundle.
- The bundle fixes the token refresh host to account.feedmedev.cc.
- Token refresh sends its argument in a POST body to that host.
- After a normal authenticated request gets a 401, the code passes the active session token to refreshAuth.
- The bundle configures its ordinary portal and inventory backends on feedmeapi.com hosts.
Evidence against
Behavioral surface
EvalFilesystemNetwork
HighEntropyStringsMinifiedTelemetryUrlStrings
NoLicense
Oversized source lightweight scan
Source & flagged code
7 flagged · loading sourcedist/EmailDialog.vue_vue_type_script_setup_true_lang-Dne_9P3j.jsView file
30140var Oe = this.pdf, Ke = this.pdf.internal.scaleFactor, it = Oe.internal.getFontSize(), ut = Oe.getStringUnitWidth(ue) * it / Oe.internal.scaleFactor;
L30141: return new function(wt) {
L30142: var Nt = (wt = wt || {}).width || 0;
High
Eval
Package source references dynamic code evaluation.
dist/EmailDialog.vue_vue_type_script_setup_true_lang-Dne_9P3j.jsView on unpkg · L30140dist/app-D38sV2ls.jsView file
6var Bu = ($, g, f) => HI($, typeof g != "symbol" ? g + "" : g, f), Ru = ($, g, f) => g.has($) || J_("Cannot " + f);
L7: var Ae = ($, g, f) => (Ru($, g, "read from private field"), f ? f.call($) : g.get($)), ht = ($, g, f) => g.has($) ? J_("Cannot add the same private member more than once") : g inst...
L8: import { isRef as GI, ref as vi, shallowRef as YI, watchEffect as WI, computed as gn, h as j_, defineComponent as Qm, createBlock as QI, renderSlot as KI, createCommentVNode as ZI,...
...
L129: usage: {
L130: body: "{subject} is still used by the following items:",
L131: module: {
...
L10894: else {
L10895: if (n.charCodeAt(0) === 36)
L10896: throw new Error("Unknown operation " + n);
...
L11176: if (O && typeof O != "string")
L11177: throw new Error("Ability.can expects 3rd paramete
Findings
3 Critical3 High3 Medium6 Low
CriticalCredential Exfiltrationdist/app-D38sV2ls.js
CriticalTrigger Reachable Dangerous Capabilitydist/app-D38sV2ls.js
CriticalPrevious Version Dangerous Deltadist/feature-CsPbMoeJ.js
HighEvaldist/EmailDialog.vue_vue_type_script_setup_true_lang-Dne_9P3j.js
HighTrigger Reachable Credential Exfiltrationdist/app-D38sV2ls.js
HighSemantic Analysis Limiteddist/App-5GYyCfFq.js#virtual:string-array:round1
MediumNetwork
MediumOversized Source Filedist/app-D38sV2ls.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to @feedmepos/mf-inventory-portal@1.8.0-dev.20.
The versions list below shows the verdict for each recorded version.
- Avoid installing @feedmepos/mf-inventory-portal@1.8.0-dev.20. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.